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AMENDMENT TO THE CLAIMS 



1 . (Previously Presented) The method accojfdiug to Claim 28, 
further comprising: 

constructing a user cluster index for the user; 

wherein the user cluster index comprises a list of families of data to 
which data from the digital data gathering results of the user were! categorized; 

monitoring families of the fiuther digital data gatheriQg results of the 

user; and 

con^ariagthe famiUes of tiie further digital data gathering results of the 
user to the user cluster index to determine anomalies m the digjtal data gathering 
results. 



2. (Previously Presented) The method a 
further comprising; 

conq)aring the anomalies to the user cluster index to 
of anomalies to existing clusters; and 

reporting a potential misuse when the ratio exceec^s 

threshold. 



ccording to Claim 1, 
determine the ratio 
a predetermined 
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3. (Previously Presented) The method according to Claim 1, 
further comprising: 

constructing a u$er lexicon for the user; 

wherein the user lexicon comprises a list of words o\ phrases gathered 
from the digital data gathering results of the user; and 

comparing words or phrases gathered from the fiuther digital data 
gathering results to the user lexicon to determine anomalies iji the digital data 
gathering results. 



according to Claim 3, 
e ses gathered from 



4, (Previously Presented) The method 
wherein the user lexicon fiirther comprises a list of words or phr; 
the monitoring of the queries; and 

comparing the further content of the fiirther query to the user lexicon 
to deteraiine any anomaly by the finrther query. 



5. (Previously Presented) The method acc()rding to Claim 3, 
fiirther comprising: 

detem:jiuing a ratio of anomalies to words or phrases 
reporting a potential misuse when the ratio excee<3|s 

threshold. 



6. (Previously Presented) The method 
wherein the user lexicon , comprises a list of words or word 
particular words or types of words, or both, extracted from 
response to user queries. 
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m the lexicon; and 
a predetermined 



accbrding to Claim 3, 
i strings identifying 
dociimients returned in 
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7. (Previously Presented) The method acccfrding to Claim 1, 
further con^rising: 

constructing a structured data profile for the user; 

wherein the structured data profile comprises a list <[)f data identifying 
en^loyment characteristics of the user; 

comparing the further digital data gathering results of the user to the 
structured data profile to detemiine whether the further digital data gathering results 
are congruent with the structured data profile; and 

identifying a potential misuse when 4ke digital data gajthering results arc 
not congruent with the structured data profile. 



8, (Previously Presented) The method according 
wherein the structured data profile conq)ii$es a stmctured data profile 
and phrases indicating valid user activity. 



to Claim 7, 
lexicon of terms 



9, (Previously Presented) The method acc<f)rding to Claim 3, 
further conc^rising; 

constructing a structured data profile for the user; 

wherein the sstructured data profile comprises a list j^f data identifying 
en^loyment characteristics of the user; 

comparing the further digital data gatiiering results 
structured data profile to determine whether the further digital dat^ gathering results 
are congruent with the structured data profile; and 

identifying a potential misuse when the further distal data gathering 
results are not congruent widi the structured data profile. 
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1 0. (Curreiatly Amended) A roethod for idei itifying the misiise 
of authorized access to a digital data gathering system by a user, Comprising: 

monitoring a content of digital data gathering rekults of the user, 
wherein the content includes at least one of words and phrases; 

constructing a user lexicon for [[a]] user of [[£.]] ihs. digital data 
gathering system; 

wherein the iiser lexicon comprises a list of at l e ast s o m e o f tl^ c a 



plurality of words or phrasps gathered from documents of the digStal data gathering 
results of the user; 

monitoring a i further content of further digital dats. gathering results 
obtained by the user; 

comparing words or phrases of the further content to the user lexicon 
to determine anomalies in the fiirthcr digital data gathering results; and 

identifying a potential misuse when an anomaly is c^etected. 



1 1 . (Previously Presented) The method acco|"ding 
further comprising: 

detcraiining a ratio Of anomalies to the words or phra|s 

and 

reporting a potential misuse when the ratio exceed^ 

threshold. 



1 2. (Previously Presented) The method acco n 
whereia the user lexicon cotnprises a list of words or word strings 
extracted from docimients retumed in response to user queries 
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a predetermined 
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The method acco] ding to Claim 10, 



1 3 - (Currejatly Amended) 
further comprising: 

constructing a structured data profile for [[a]] flis xisen of [[a]] ^ digital 
data gathering system; 

wherein tiie structured data profile con^rises a list data identifying 
en^loyment characteristics!' of the user; 

comparing the further digital data gathering results of the user to the 
structured data profile to determine whether the further digital dat i gathering results 
ar e c o ng r uent rnrrfispond \iC^ith the structured data profile; and | 

identifying a potential tnisuse when the further digital data gathering 
results AIL nut consi ' ue.nt do not correspond with the structured dita profile. 



14- (Currently Amended) A method for identifying the misuse 
of authorized access to a digital data gathering system by a user, comprising: 

constructing a structured data profile for [[a]] ihfi useii of [[a]] Ihe digital 
data gathering system; 

wherein the sitructured data profile comprises a list of data identifying 
employment information of the user; 

monitoring digital data gathering results of the user!; 

con:q)ariiig digital data gathering results of the user to i 
profile to determine whether the digital data gathering resu|lts die Lungiucnt 
correspond with the structured data profile; and 

identifying a potential misuse when the digital data gathering results tktc 
n o t c o ng r uen t Hn not rnrrRspond with the stmctured data profile. 



the structured data 
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Claims 15-16' 



(Canceled) 



17. (Previously Presented) The method accoifding to Claim 29, 
ftrtiier comprising; wei^ting anomalies identified according to ihc. user lexicon, the 
user cluster index, and the structured data profile to determine a Report of potential 
misuse. 

18. (Currently Amended) The method accoj'ding to Claim 29, 
forther comprising: sending a notification of potential misuse wheiji [[a]] an anomaly 
is identified according to two or more of the user lexicon, the user jcluster index, and 
the structured data profile. i 

: I 

I 

1 9. (Previously Presented) The method according to Claim 29, 
wherein the user lexicon coijnprises a list of words or phrases gathe red from metadata 

of documents retumed in the query results- j 

I 
I 

20. (Previously Presented) The method according to Claim 29, 
wherein the user lexicon conr^rises a list of words, or types of words, or both, 
extracted from documents retumed in the query results. 

21- (Previously Presented) The method according to Claim 29, 
wherein the user cluster index comprises a list of families of topic; data to which the 
data of the user information retrieval results have been categorized. 
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22. (Curreiatly Amended) A method fox detecting misuse by a 

user of an inforaiation retrieval system having a document cdllection, wherein 

I 

documents of the document collection axe categorized into onej of a plurality of 

j 

clusters according to topic, the method comprising: j 

tracking the one of the plurality of clusters from whlich any dociraient 

read by the user originates; 

building up a proiSle of use for the user based 0:1 most frequently 

accessed clusters ov e r a time sufficien t to establish a c o nfidence thrpsh o lJ for validity 



of the profile o f the use r; 

tracking each time the user retrieves and reads a dctcument outside of 
the most frequently accessed clusters; and 

establishing a misuse threshold number for documehts read outside of 
the most frequently accessed clusters and after the misuse threshold number is 
obtained, signaling that a potential misuse may have occurred. 



23 . (Currently Amended) A method for detjecting misuse by a 
user of an infomiation retrieval system having a document coUectipn, comprising the 
steps of: 

retrieving documents in response to user queries 
clustering the retrieved documents intQ.clusters by category based upon 
a content of each of the retrieved documents^ wherein tiic content includes at least one 
of terms> pbxaseS:, and topics; 

estabhshing and obtaining a threshold number of retrieved documents 
and after the threshold mjmber of retrieved documents is obtained, determining a size 
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for each of the clusters, and further denoting clusters of a large cn o i|gh having at leagt 

I 

a predetermiTied size as valid clusters; and 

determining if a sufficient predetermined nun^ber of retrieved 

I 

doctiments do not participate in any valid cltis t er dufileia and if not, signaling 

! 

that a potential misuse may have occuned, 

24. (Currently Am^ended) A metibiod for detecting misuse by a 

user of an information retrieval system having a document collection, comprising the 

I 

steps of: j 

identifying top weighted terms from documents retrieved by the user 

from searches of the document collection and storing the top weightjed terms in a user- 

I 

specific lexicon; i 

tracking user activity until the rate of new terms added slows and the 
user-specific lexicon stabilizes to form a user profile; | 

identifying fpr each new query, if the top weighted tejrma are in the user- 
specific lexicon; 

tracking a ra^o of newly occurring temis to termg existing in ths user- 

I 

specific lexicon terms; and 

if the ratio of newly occurring terms to existing usjer-specific lexicon 
terms exceeds a threshold, signaling that a potential misuse may have occurred. 
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25, (Previpusly Presented) The method according to Claim 24, 

further comprisiag: 

I 

tagging the documents to identify words in the docijiinents by type; 

running an original query of terras and phrases; j 

selecting specific types of words from relevant documents retrieved by 
the original query and adding these terms to a second query; and j 

iteratively selecting specific types of words fromnslevant documents 
retrieved by each query and adding the selected specific types of words to a further 
query to filter the user-specific lexicon. 

26 . (Currently Amended) A method for detecting misuse by a 
user of an information retrieval system having a document collection, comprising the 
steps of: I 

identifying sttuctured data sources that ca n-be are us^d to identify what 
the user is working on; 

I 

querying ttiese sources and, for each source, mapping a structured result 
into a structured data lexicon of terms and phrases that indicate yalid user activity; 

for each new query > trackmg a ratio of terms found in the stractured data 
lexicon to those not found in the structured data lexicon; and 

if the ratio exceeds a threshold, signaling that a misuse may have 

occurred. 
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27. (Cmrehtly Amended) A method for detecting misuse by a 

I 

user of an infoEnnation retrieval system having a document collection, comprising the 
steps of: 

identifying structured data sources that can b e ats used to identify what 
the user is working on; 

querying the: identified structured data sources and, for each source 
queried, mapping a structured result into a structured data lexicon of terms and 
phrases that indicate valid tiser activity; | 

for each new query, retrieving relevant docimients for that new query; 

extracting key terms from the relevant documents; | 

identifying the ratio of key retrieved terms found in the lexicon to those 
not found in die lexicon; and 

if the ratio exceeds a threshold, sigaaling that a 

occurred- 



misuse may have 
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28. (Currently Amended) A method for identifying a misuse 
of an authorized user of an information retrieval system, the xnetijiod comprising: 

monitoring a content of a plurali t y of at least one of queries entered by 
the user and digital data gathering results obtained by the user, vjherein the content 

includes at least one of terms, phrases, and topics; i 

I 

constructing a profile of use for the user using the <pontent; 

I 

monitoring a fiirther content of at least one of a fuikher query entered 

by the user and furdier digital data gathering results obtained by the user; 

1 

coniparing thp further content to the profile of use to jleteraiine whether 
the at least one of the further query entered by the user and the further digital data 

gathering results is an anomaly; i 

i 

identifying a potential misuse when an anomaly is jietected. 



29, (Previously Presented) The method according to Claim 28, 
wherein the profile of use comprises a user lexicon of user resuU words or phrases, 
a user cluster index of result document topic categories, and a structured data profile 
of known user characteristics, and further comprising: 

con:q)aring1he further content to each of the user lej^icon of user result 
words or phrases, the user cluster index, and the structured data i^rofile. 
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